{"action":"created","issue":{"url":"https://api.github.com/repos/rsyslog/rsyslog/issues/1691","repository_url":"https://api.github.com/repos/rsyslog/rsyslog","labels_url":"https://api.github.com/repos/rsyslog/rsyslog/issues/1691/labels{/name}","comments_url":"https://api.github.com/repos/rsyslog/rsyslog/issues/1691/comments","events_url":"https://api.github.com/repos/rsyslog/rsyslog/issues/1691/events","html_url":"https://github.com/rsyslog/rsyslog/issues/1691","id":245133211,"number":1691,"title":"Ommysql don't export from CEF to MySQL","user":{"login":"gubzh","id":25663522,"avatar_url":"https://avatars3.githubusercontent.com/u/25663522?v=4","gravatar_id":"","url":"https://api.github.com/users/gubzh","html_url":"https://github.com/gubzh","followers_url":"https://api.github.com/users/gubzh/followers","following_url":"https://api.github.com/users/gubzh/following{/other_user}","gists_url":"https://api.github.com/users/gubzh/gists{/gist_id}","starred_url":"https://api.github.com/users/gubzh/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/gubzh/subscriptions","organizations_url":"https://api.github.com/users/gubzh/orgs","repos_url":"https://api.github.com/users/gubzh/repos","events_url":"https://api.github.com/users/gubzh/events{/privacy}","received_events_url":"https://api.github.com/users/gubzh/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":8,"created_at":"2017-07-24T16:17:04Z","updated_at":"2017-07-27T07:25:16Z","closed_at":null,"body":"Hi, \r\nAs described in https://stackoverflow.com/questions/45274192/export-from-cef-to-mysql-rules-rsyslog-conf\r\n\r\nI need to collect CEF logs and write them to MySQL database using rsyslog. In the rsyslog.conf registered the following rules:\r\n\r\nmodule(load=\"ommysql\")\r\nmodule(load=\"imtcp\")\r\nmodule(load=\"imudp\")\r\nmodule(load=\"mmfields\")\r\ntemplate(name=\"ceflogs\" type=\"string\" option.sql=\"on\" string=\"insert into idslogs (DeviceVendor, DeviceProduct, DeviceVersion, SignatureID, Name, Severity, Extensions_cat, Extensions_dmac, Extensions_cnt, Extensions_cs2Label, Extensions_cs2, Extensions_cs3Label, Extensions_cs3, Extensions_cs1Label, Extensions_cs1, Extensions_dst, Extensions_spt, Extensions_dpt, Extensions_proto, Extensions_deviceExternalId, Extensions_smac, Extensions_rt, Extensions_src) values ('%$!cef!DeviceVendor%', '%$!cef!DeviceProduct%', '%$!cef!DeviceVersion%', '%$!cef!SignatureID%', '%$!cef!Name%', %$!cef!Severity%, %$!cef!Extensions!cat%, '%$!cef!Extensions!dmac%', %$!cef!Extensions!cnt%, '%$!cef!Extensions!cs2Label%', '%$!cef!Extensions!cs2%', '%$!cef!Extensions!cs3Label%', '%$!cef!Extensions!cs3%', '%$!cef!Extensions!cs1Label%', %$!cef!Extensions!cs1%, '%$!cef!Extensions!dst%', %$!cef!Extensions!spt%, %$!cef!Extensions!dpt%, '%$!cef!Extensions!proto%', %$!cef!Extensions!deviceExternalId%, '%$!cef!Extensions!smac%', %$!cef!Extensions!rt:::date-mysql%, '%$!cef!Extensions!src%')\")\r\nruleset(name=\"remote\") {\r\naction(type=\"mmfields\")\r\naction(type=\"ommysql\" server=\"localhost\" db=\"dbname\" uid=\"root\" pwd=\"password\")\r\n}\r\ninput(type=\"imtcp\" port=\"514\" ruleset=\"remote\")\r\ninput(type=\"imudp\" port=\"514\" ruleset=\"remote\")\r\n\r\n\"nc -l -u 514\" shows incoming logs in CEF format, but logs are not written to MySQL database. What needs to be changed in rsyslog.conf."},"comment":{"url":"https://api.github.com/repos/rsyslog/rsyslog/issues/comments/318281500","html_url":"https://github.com/rsyslog/rsyslog/issues/1691#issuecomment-318281500","issue_url":"https://api.github.com/repos/rsyslog/rsyslog/issues/1691","id":318281500,"user":{"login":"gubzh","id":25663522,"avatar_url":"https://avatars3.githubusercontent.com/u/25663522?v=4","gravatar_id":"","url":"https://api.github.com/users/gubzh","html_url":"https://github.com/gubzh","followers_url":"https://api.github.com/users/gubzh/followers","following_url":"https://api.github.com/users/gubzh/following{/other_user}","gists_url":"https://api.github.com/users/gubzh/gists{/gist_id}","starred_url":"https://api.github.com/users/gubzh/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/gubzh/subscriptions","organizations_url":"https://api.github.com/users/gubzh/orgs","repos_url":"https://api.github.com/users/gubzh/repos","events_url":"https://api.github.com/users/gubzh/events{/privacy}","received_events_url":"https://api.github.com/users/gubzh/received_events","type":"User","site_admin":false},"created_at":"2017-07-27T07:25:16Z","updated_at":"2017-07-27T07:25:16Z","body":"This is message from mysqld.log\r\n\r\n> Connect\troot@localhost on dbname\r\nQuery\tset autocommit=0\r\nQuery\tinsert into table (`DeviceVendor`, `DeviceProduct`, `DeviceVersion`, `SignatureID`, `Name`, `Severity`, `Extensions_cat`, `Extensions_dmac`, `Extensions_cnt`, `Extensions_cs2Label`, `Extensions_cs2`, `Extensions_cs3Label`, `Extensions_cs3`, `Extensions_cs1Label`, `Extensions_cs1`, `Extensions_dst`, `Extensions_spt`, `Extensions_dpt`, `Extensions_proto`, `Extensions_deviceExternalId`, `Extensions_smac`, `Extensions_rt`, `Extensions_src`) values ('', '', '', '', '', , , '', , '', '', '', '', '', '', '', , , '', , '', , '')\r\nQuit\t\r\n"}}
{"actor":{"display_login":"gubzh"}}